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Fintech Startup BharatPe Automates Security 


with Cloudflare 


Fueled by ultra-low mobile data prices, inexpensive smartphones, and 4G 
penetration, mobile data consumption in India skyrocketed 56-fold between 2014 


and 2018. It was against this backdrop that Bhavik Koladiya co-founded BharatPe, 
a merchant payment processing company aimed at more than 10 million small and 
medium-sized businesses (SMBs) in India that don't have an Internet presence. BharatPe 


BharatPe empowers these merchants by offering them a single interface through 
which they can accept any payment apps — over 150 of which are available in India 
— at no cost to the business. All merchants need to do is sign up, download a single 


QR code for their customers to scan, and start accepting payments, which are Key Results 


transferred directly into their bank accounts. "Electronic deposits are an enormous è 
convenience in rural India,” Koladiya notes, "because the nearest bank could be 20 
miles away.” 


Cyberattacks force other engineering projects to the back burner 


Cybersecurity has been a central concern for Koladiya since BharatPe's early days, 
in part because the platform came under attack as soon as it launched. “Every 
day, we were getting pummeled with attacks from Russia, from China, from 
everywhere,” he explains. “The hackers just kept coming, targeting our open APIs 
with SQL injections and brute force attacks." 


These attacks impeded BharatPe's ability to scale effectively as the platform took 
off. Within a year of launching, they had onboarded over 2.5 million merchants, 
and had gone from processing 300 transactions per day to processing over 1.5 
million. Yet the company's engineers kept being pulled into time-intensive security 
projects like identifying their attackers’ IPs, a task that took nearly three months. 
“Literally half of my back-end team's focus was going into preventing cyberattacks,” 
Koladiya says. “Everything else had to go on the back burner.” 


These attacks also risked something equally important as growth: customers’ 
trust. “Vendors rely on us to make their living,” says Koladiya. “Typical high-growth 
startups usually focus on scale first, and then security, but we're in the payment 
business. Security has to come before scale.” 
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Used Cloudflare WAF and Bot 
Management to fend off relentless 
cyberattacks 


Slashed onboarding time for 
new banking partners from three 
months to less than a week 


Able to rely on a single point of 
contact for expert technical support 
— at any time of the day or night 
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Cloudflare security solutions provide peace of mind and time to scale 
business needs 


Koladiya was assembling a four- to five-person team that would be dedicated 
solely to fending off cyberattacks when a business associate told him about 
Cloudflare. He was initially skeptical that anyone could solve his massive security 
problems with an automated solution, but agreed to a meeting. 


“They showed us what their WAF (web application firewall) could do, and we were 
very impressed,” he recalls. “It looked like it could solve our problems immediately.” 


It did. Koladiya and his team went from being locked in a constant battle with 
hackers to watching the Cloudflare WAF lock cybercriminals out. “Since we 
implemented the WAF, we haven't devoted a single man-hour to fixing a security 


problem,” Koladiya says. “We were spending so 


Thrilled with the immediate results they saw with the WAF, BharatPe began 


much time dealing with 
investigating how Cloudflare's solutions could be implemented in other areas of 


cyberattacks that it impeded 


the business. For example, BharatPe is building a new platform for shoppers that 
will allow them to perform a location search for merchants that accept certain the growth of the business. 
apps. This process will require BharatPe to expose their database, which makes Partnering with Cloudflare 


them vulnerable to automated data scraping attacks. 
allows my team to focus on 
“With Cloudflare Bot Management, we won't have to worry about that,” says 


, ; 
Koladiya. “Instead of trying to configure the code ourselves, we can incorporate what they iS good at, knowing 


Bot Management and focus on building a product that users will love.” that security is taken care of.” 
In addition to strengthening BharatPe's security, Cloudflare has dramatically 

minimized the time it takes to onboard new banking partners. "Before partnering Bhavik Koladiya 

with Cloudflare, Koladiya says, "it took the team nearly three months to integrate Co-founder, BharatPe 


one API with a bank. Now, it takes less than a week.” 


A single point of contact to call anytime — even at 3 a.m. 


Extreme time zone differences can present a big challenge when international 
companies decide to partner with Silicon Valley firms; as Americans prepare for 
sleep, Indian companies are just starting their day. Koladiya says that Cloudflare 
stands out in this area as well. 


“We have a single point of contact that we can call in the middle of the night for 
technical support,” he says. “If my engineers are having a problem at 3:00 a.m., 
they can't wait for an office to open at 9:00 a.m. Pacific Time. Having a contact 
that | can pick up the phone and talk to at any time of the day or night is huge.” 


Koladiya is a veteran in the startup space and has worked with other vendors, but 
he says he would recommend Cloudflare over the competition without hesitation. 


“If a startup founder came to me and said they were worried about security or scale, 
| would tell them to partner with Cloudflare. Cloudflare knows what they're doing. 
You can just let them do what they're good at, and you can focus on the things that 
you're good at.” 


